topic Re: query help in Splunk Cloud Platform

query help

Praz_123 — Thu, 09 Oct 2025 14:24:46 GMT

query is -

index="_internal" source="*license_usage.log" type=Usage h="abc" earliest=-3d@d latest=@d | stats sum(b) as usage by _time | eval usage_in_GB = usage / 1024 / 1024 / 1024 | timechart span=1d sum(usage_in_GB) as usage_GB

with the query I can see for specific host but I need a query to see top 10 host which are using daily more than 2gb usage

while using the below am not getting the results :-

index="_internal" source="*license_usage.log" type=Usage earliest=-3d@d latest=@d
| stats sum(b) as usage by _time, h
| eval usage_in_GB = usage / 1024 / 1024 / 1024
| where usage_in_GB > 2
| stats sum(usage_in_GB) as total_usage_GB by h
| sort - total_usage_GB
| head 10

Re: query help

livehybrid — Thu, 09 Oct 2025 14:55:16 GMT

Hi @Praz_123

Try using the bin command before your first stats, something like this should work:

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: query help

PrewinThomas — Fri, 10 Oct 2025 04:26:33 GMT

@Praz_123
For each day if you want to check try below,